ethernet/netronome/nfp: Fix a use after free in nfp_bpf_ctrl_msg_rx

Browse source

In nfp_bpf_ctrl_msg_rx, if
nfp_ccm_get_type(skb) == NFP_CCM_TYPE_BPF_BPF_EVENT is true, the skb
will be freed. But the skb is still used by nfp_ccm_rx(&bpf->ccm, skb).

My patch adds a return when the skb was freed.

Fixes: bcf0cafab4 ("nfp: split out common control message handling code")
Signed-off-by: Lv Yunlong <lyl2019@mail.ustc.edu.cn>
Reviewed-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>

...

This commit is contained in:

Lv Yunlong 2021-03-29 04:50:02 -07:00 • committed by David S. Miller

parent ca441a7129

commit 6e5a03bcba

1 changed files with 1 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

1

drivers/net/ethernet/netronome/nfp/bpf/cmsg.c

View file